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WHAT IS CLAIMED IS : 

1 . A method for detecting spam, comprising: 
identifying normal users visiting a web site; and 

determining an occurrence of spamming on the web site based at least in part on 
the identified normal users. 

2. The method of claim 1 wherein the identifying normal users includes: 
tracking activities of users visiting the web site. 

3. The method of claim 2 wherein the tracking activities includes: 
determining whether the users load images. 

4. The method of claim 2 wherein the tracking activities includes: 
determining whether the users have javascript turned on. 

5 . The method of claim 2 wherein the tracking activities includes: 
determining a type of browser used by the users. 

6. The method of claim 2 wherein the tracking activities includes: 
determining an interval at which each of the users visits the web site. 
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7. The method of claim 2 wherein the web site is a search engine, and 
wherein the tracking activities includes: 

determining a type of items for which searches are performed by the users. 

8. The method of claim 2 wherein the tracking activities includes: 
tracking activities of users visiting another web site. 

9. The method of claim 2 wherein each of the users is associated with a cookie 
identifier, and 

wherein the tracking includes: 

using the cookie identifiers to track the activities of the users. 

10. The method of claim 1 wherein each of the users is associated with a cookie 
identifier, and 

wherein the identifying normal users includes: 

identifying normal users based at least in part on an age of the cookie 
identifiers associated with the users. 

11. The method of claim 1 wherein each of the users is associated with a network 
address, and 

wherein the identifying normal users includes: 
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identifying the norma] users based at least in part on the network addresses 
associated with the users. 

12. The method of claim 1 wherein the web site includes at least one advertisement, 

and 

wherein the determining an occurrence of spamming includes: 

determining a click rate of the at least one advertisement for the identified 

normal users, and 

determining that the at least one advertisement has been spammed when 
the click rate of users visiting the web site exceeds the determined click rate for the identified 
normal users. 

13. The method of claim 12 wherein the click rate includes a range of click rates. 

14. The method of claim 1 wherein the web site includes at least one advertisement, 
wherein the identifying includes: 

determining a percentage of a number of users visiting the web site in a 
time period that are normal users, and 

wherein determining an occurrence of spamming includes: 

estimating a percentage of normal users selecting the at least one 
advertisement during the time period to be approximately the percentage of normal users visiting 
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the web site during the time period, and 

determining that the at least one advertisement has been spammed when 
an actual percentage of normal users selecting the at least one advertisement during the time 
period is lower than the estimated percentage of normal users selecting the at least one 
advertisement during the time period. 



15. The method of claim 1 wherein the determining includes: 

determining an occurrence of spamming of at least one advertisement on the web 

site, and 

wherein the method further comprises: 

providing a refund in response to determining that the at least one 
advertisement has been spammed. 



16. A system for detecting click spam at a web site, comprising: 
means for identifying normal users visiting a web site; and 
means for determining an occurrence of click spanuning on the web site based at 
least in part on a behavior of the identified normal users. 



1 7. A computer-readable medium containing instructions for controlling at least one 
processor to perform a method for detecting click spamming of an advertisement on a server, the 
method comprising: 
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determining a number of normal users accessing the server; 

determining a percentage of the normal users clicking the advertisement when the 
advertisement is displayed to the normal users; and 

determining whether the advertisement has been click spammed based at least in 
part on the determined percentage. 

18. A server comprising: 

a memory configured to store at least one advertisement; and 

a processor configured to: 

cause the at least one advertisement to be displayed, 
determine a number of normal users accessing the server, 
determine a percentage of the normal users clicking the at least one 

advertisement, and 

determine whether the advertisement has been click spammed based at 
least in part on the determined percentage. 

19. A method for determining whether an item on a web site has been click spammed, 
comprising: 

identifying a group of normal users visiting the web site; 
determining a cHck rate of the item for the group of normal users; and 
determining whether the item has been click spammed based at least in part on the 
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detennined click rate for the normal users. 

20. The method of claim 19 further comprising: 
determining a total number of users visiting the web site, and 

wheriein the determining whether the item has been click spammed includes: 

comparing the determined click rate for the normal users to a click rate for 

the total number of users visiting the web site, and 

determining that the item has been click spammed when the click rate for 

the total nxmiber of users exceeds the determined click rate for the normal users. 

2 1 . The method of claim 1 9 wherein the identifying includes: 
tracking an activity of users visiting the web site, and 

identifying the group of normal users based at least in part on the tracked activity. 

22. The method of claim 21 wherein the tracking includes determining, for each user, 
at least one of whether the user loads images, an age of a cookie associated with each user, 
whether the user has javascript turned on, a type of browser used by the user, and an interval at 
which the user visits the web site. 

23. The method of claim 1 9 further comprising: 

taking remedial measures in response to determining that the item has been click 
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spammed- 

24. The method of claim 19 wherein the determining a cUck rate of the item for the 
group of normal users includes: 

estimating a percentage of normal users visiting the web site, and 
setting a percentage of clicks of the item from normal users to approximately 
equal the estimated percentage. 

25. The method of claim 24 wherein the determining whether the item has been click 
spammed includes: 

determining whether an actual click rate of the item for the group of normal users 
differs from the set click rate. 

26. The method of claim 19 wherein the determining a click rate of the item includes: 
determining different click rates of the item for the group of normal users, the 

different click rates corresponding to different time periods. 

27. The method of claim 26 wherein the different time periods include different times 
of a day or week. 



28. 



The method of claim 26 wherein the different time periods include different 
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months of a year. 



29. A computer-readable medium containing instructions for controlling at least one 
processor to perform a method for detecting a spamming of an advertisement displayed by a 
server, the method comprising: 

identifying normal users visiting the server; 

determining a click rate of the advertisement for the normal users; and 
determining whether the advertisement has been spammed based at least in part 
on the determined click rate for the normal users. 



30. A server comprising: 

a memory configured to store at least one item; and 

a processor configured to: 

cause the at least one item to be displayed, 

identify a number of normal users accessing the server, 

compare the number of normal users to a total number of users to obtain a 

percentage, 

set a click rate of the at least one item based at least in part on the 

percentage, and 

determine whether the at least one item has been spammed based at least 
in part on the click rate. 
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31. A method for identifying normal users visiting a web site, comprising: 
tracking activities of users visiting the web site, the tracking including 
determining, for each user, at least one of whether the user loads images, an age of a cookie 
associated with each user, whether the user has javascript turned on, a type of browser used by 
the user, and an interval at which the user visits the web site; and 

identifying normal users based at least in part on the tracked activities. 
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